The number of eventfd that can be handled per peer is limited by the
number of vectors. Return an error when receiving too many of them.
Signed-off-by: Marc-André Lureau <marcandre.lur...@gmail.com>
---
hw/misc/ivshmem.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index 11b49c3..ade7456 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -570,6 +570,13 @@ static void ivshmem_read(void *opaque, const uint8_t *buf,
int size)
}
/* get a new eventfd */
+ if (peer->nb_eventfds >= s->vectors) {
+ error_report("Too many eventfd received, device has %d vectors",
+ s->vectors);
+ close(incoming_fd);
+ return;
+ }
+
nth_eventfd = peer->nb_eventfds++;
/* this is an eventfd for a particular peer VM */
--
2.4.3
